Analysis
-
max time kernel
109s -
max time network
145s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
02/01/2024, 07:42
General
-
Target
0c483a592b5c08233fdc93e06d383f30253b23e5e382e73d9ea74c766cf47276.exe
-
Size
536KB
-
MD5
47f392abce7ba6ee9827f4b3d2a84653
-
SHA1
54c79c2455dba8aead524b179c8e8dcc754867d7
-
SHA256
0c483a592b5c08233fdc93e06d383f30253b23e5e382e73d9ea74c766cf47276
-
SHA512
3027d8432c96dc2fcbb5e3ff27d7d4300d2f8a365bfc42fb828b20f336fbfad98c20966b0cc618f9ada3cd76acf4c782b42d04f65e83c3bfb1e88afd89e6ae46
-
SSDEEP
12288:xhf0Bs9bDDq9hu53Ltp/p+gPhhwPOaoTJRkmOkx2LIa:xdQyDL9xp/BGA1RkmOkx2LF
Malware Config
Signatures
-
UPX packed file 7 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Unexpected DNS network traffic destination 4 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
-
Drops file in Windows directory 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 12 IoCs
-
Suspicious use of AdjustPrivilegeToken 5 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
C:\Users\Admin\AppData\Local\Temp\0c483a592b5c08233fdc93e06d383f30253b23e5e382e73d9ea74c766cf47276.exe"C:\Users\Admin\AppData\Local\Temp\0c483a592b5c08233fdc93e06d383f30253b23e5e382e73d9ea74c766cf47276.exe"2⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5ac014cef6cfe67878d8c40ab763bdf4a
SHA19213d01d7e180e9d62f8bcf12e41a3c1024a7240
SHA256bc357cfeb8ec83a9f81951778964baf14f360e23f870da4301f1ea222de70f72
SHA5128cac47116a686f8fdbf73dd5980ab41907a58cbd86e71bd61e7a51350fd3735f3b558e425d367fa62b578e14bbb9da18c6458f4735bed1d46e40d3222e888e93
-
Filesize
938B
MD5596efc00ea4325ff6b4ab2347a5956ec
SHA165cd651905b293b692ef87a30b0a8235608078ce
SHA256c2e26e0caae647d3c482ee241841ce423be2e462d70abf4b75bd7436457cf9ed
SHA512de9bd24915bb11921192fb7747f124397855a46a65b5f022d41321e836beec7128e095b1abf8201d2e01682e3b594f69907085eefa558f6f04f1e46e06759b90
-
Filesize
502B
MD557f4174600785b8b92b867ab7bf100c7
SHA1c465291ea0c592ee2e749d4ef348278aa9cb6c2e
SHA256bafbae0a50497e3af321bc3cad1c733201444bb518f31d1c44f6eb4e8d1fa112
SHA512e317db7e1fa6ecf5ad3fd0301545ea4bdd79cb1ff2d44f9cf1c543968ed8909b06883c32e5e5f0b1bcacf7554e942180d7b3a841ce47c2bdc6fcdbb890cf8671
-
Filesize
520B
MD58b625d0f213bc33437102c33e6c49faa
SHA1346221e6484098424ae1edb2aec1cb97f6359088
SHA256b05e9d702e3cc5381ecfd4aae8ca0316bfd42deea7e67996cd73095fe83b0531
SHA51226c2b44c5b8337dee2ba0222bec521a95f3e2e3e911ee77a5e8e527a3c98c0eea91d3c0f6a8918ac0552e6f6adf13804ff8aef0a0b9116767cd0e7e113204f70
-
Filesize
12KB
-
Filesize
484KB
-
Filesize
484KB
-
Filesize
484KB
-
Filesize
12KB
-
Filesize
1.0MB
-
Filesize
1.0MB
-
Filesize
1.0MB
-
Filesize
1.0MB
-
Filesize
1.0MB
-
Filesize
1.0MB
-
Filesize
1.0MB